CVE-2025-70866

CVE-2025-70866 — LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low privileges (User role) can directly access the admin backend via /admin/login because the admin and user authentication guards share the same user provider without role-based access cont...

CVE-2025-70866

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges User role can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider...

CVE-2025-70866

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges User role can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider...

PT-2026-25757

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Description Mattermost does not properly validate a user's authentication method when processing an account authentication type switch. This allows an authenticated attacker to change an account...

CVE-2026-25748

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious...

CVE-2026-25748 authentik has a forward authentication bypass with broken cookie

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious...

CVE-2026-25748

The vulnerability CVE-2026-25748 affects authentik prior to 2025.10.4 and 2025.12.4 in the Proxy Provider when used with Traefik or Caddy as reverse proxy. A malformed cookie could bypass authentication during forward authentication, causing missing authentik headers (X-Authentik-*) and potential...

AZL-77417 CVE-2026-2005 affecting package postgresql for versions less than 16.12-1

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

CVE-2026-2005 PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

PT-2026-7893

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.10.4 authentik versions prior to 2025.12.4 Description authentik is an open-source identity provider. A malformed cookie could bypass authentication when using forward authentication with the authentik Proxy...

PT-2026-7894

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.8.6 authentik versions prior to 2025.10.4 authentik versions prior to 2025.12.4 Description authentik is an open-source identity provider. When using a SAML Source with the 'Verify Assertion Signature' option...

[SECURITY] Fedora 42 Update: rust-afterburn-5.10.0-3.fc42

A simple cloud provider agent...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: argo-events, incert, certificate-transparency, grafana-operator, kubevela, mc, kubernetes, mattermost, kubeflow-pipelines, spicedb-operator, malcontent, ferretdb, grafana-agent-operator, mailpit, nri-apache, apache-exporter, xeol, kube-logging-operator-custom-runner,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: argo-events, incert, certificate-transparency, grafana-operator, kubevela, mc, kubernetes, mattermost, smarter-device-manager, gitea, kubeflow-pipelines, velero-plugin-for-microsoft-azure, multus-cni, spicedb-operator, ferretdb, grafana-agent-operator, mailpit,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: argo-events, incert, certificate-transparency, grafana-operator, kubevela, mc, kubernetes, mattermost, smarter-device-manager, gitea, kubeflow-pipelines, velero-plugin-for-microsoft-azure, multus-cni, spicedb-operator, ferretdb, grafana-agent-operator, mailpit,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, newrelic-infra-operator, nodetaint, bank-vaults, prometheus-bind-exporter, rclone-fips, mods, git-credential-oauth, kubernetes-dashboard-auth-fips, seaweedfs-operator-fips, regclient-fips, kubernetes-ingress-defaultbackend,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, newrelic-infra-operator, nodetaint, bank-vaults, prometheus-bind-exporter, rclone-fips, mods, git-credential-oauth, kubernetes-dashboard-auth-fips, seaweedfs-operator-fips, regclient-fips, kubernetes-ingress-defaultbackend,...

[SECURITY] Fedora 43 Update: rust-afterburn-5.10.0-3.fc43

A simple cloud provider agent...

Siemens SCALANCE and RUGGEDCOM Covert Timing Channel (CVE-2025-9231)

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private...

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...